What are the stages of the incident response lifecycle?

The commonly taught stages are preparation, detection and analysis, containment, eradication, recovery and lessons learned. They form a loop, because what you learn at the end feeds back into better preparation for the next incident.

What is the difference between containment and eradication?

Containment stops the incident spreading, for example by isolating a system or disabling an account. Eradication then removes the underlying cause, such as malware or the exploited weakness. Containment comes first so the damage stops growing while the cause is dealt with.

A CSIRT is a computer security incident response team, the group responsible for handling security incidents. It usually combines technical investigators with colleagues from management, legal and communications, and works from a plan agreed in advance.

How is incident response different from disaster recovery?

Incident response deals specifically with security incidents, from detection through to lessons learned, while disaster recovery focuses on restoring systems and data after any serious disruption. They overlap at the recovery stage and are commonly planned together.

Cloud basics

What is incident response? The lifecycle explained

By the SaveMyCert Editorial TeamPublished 5 Oct 2026Updated 5 Oct 2026

Incident response is the structured process an organisation follows to detect, contain and recover from a security incident, limiting the damage and learning from what happened. The central idea is that you decide how to respond before something goes wrong, not during it, because decisions made calmly in advance are better than decisions made in a panic. This article explains why a plan matters, walks through the lifecycle step by step, describes who is involved, and shows how incident response relates to disaster recovery and to detection tools such as a SIEM.

Why you need a plan before an incident

A plan matters because an incident is a stressful, fast-moving situation in which people otherwise improvise. Without agreed steps, nobody is sure who decides, who is told, or whether to switch a system off, and valuable evidence can be lost. With a plan, roles are clear, contact details are to hand, and the team has rehearsed the first hour. The aim is not to prevent every incident, since that is not realistic, but to make sure a bad day does not become a disaster.

The lifecycle, step by step

Frameworks word it slightly differently, but the commonly taught lifecycle has six stages, and they run as a loop rather than a straight line:

Preparation — build the plan, the team, the tools and the logging before anything happens, and practise with exercises.
Detection and analysis — notice that something is wrong, confirm it is a real incident, and work out its scope and seriousness.
Containment — stop it spreading, for example by isolating affected systems or disabling compromised accounts, while preserving evidence.
Eradication — remove the cause, such as malware, a malicious account or the vulnerability that was exploited.
Recovery — restore systems to normal operation safely and watch closely for any sign of a return.
Lessons learned — review what happened and improve the plan, the controls and the detection so it is harder next time.

Who is involved

Incident response is usually run by a dedicated team, often called an incident response team or CSIRT (computer security incident response team), drawing in people from across the organisation. Technical staff investigate and fix; managers make decisions; and legal, communications and leadership contribute when data, customers or regulators are affected. Having named roles in advance is what stops a response from stalling.

Detection and disaster recovery

The second stage depends on being able to see what is happening, which is where a SIEM comes in. Our what is a SIEM explainer covers how logs are brought together and turned into alerts. Recovery, the fifth stage, overlaps with disaster recovery, which focuses on restoring systems and data within target times; our what is disaster recovery, RTO and RPO article covers those ideas. The two are related but not identical: disaster recovery covers any serious disruption, while incident response is specifically about security events.

In the cloud and in study

In the cloud the same lifecycle applies, with the added need to understand which parts the provider handles and which are yours, a point our what is cloud security article explains through shared responsibility. Incident response is a named domain in foundational security study such as ISC2 Certified in Cybersecurity and features in the AWS Certified Security – Specialty. Our /revision library covers that syllabus lesson by lesson.

Ready to start studying — free?

Original practice questions, timed mock exams and revision notes. No card, nothing to pay.

Jump straight into an exam

SCS-C03 CC

Questions, answered

Incident response is the structured process an organisation follows to detect, contain and recover from a security incident, limiting damage and learning from it. It is planned in advance so that people know what to do when something goes wrong.

Sources

Exam details in this post come from the vendor's published exam guide, which is the authority on what is tested and how.

ISC2 Certified in Cybersecurity exam outline — ISC2
AWS Certified Security – Specialty (SCS-C03) exam guide — Amazon Web Services